Problem Statement
Outline a quick Kubernetes hardening plan for a production cluster.
Explanation
Enforce Pod Security Standards at restricted where possible, baseline elsewhere, using Pod Security Admission. Lock down network with namespace-scoped Network Policies so only required flows are allowed. Use minimal images, read-only root filesystems, and run as non-root. Rotate secrets and prefer external secret managers. Restrict node metadata access and audit RBAC for least privilege. Capture and ship audit logs. These steps reduce breakout, lateral movement, and credential theft in real clusters.
Code Solution
SolutionRead Only
Namespace labels: pod-security.kubernetes.io/enforce=restricted; create default-deny netpol; allow only app→db ports
